Location Intelligence Management System for Border Security

ABSTRACT

Collection and analysis of network transaction information which includes the mobile device&#39;s usage, location, movements coupled with data from non-wireless network sources allow for the automation of analysis for the detection of smuggling or other criminal behaviors and tasking of high-accuracy location surveillance.

CROSS REFERENCE

This application is a continuation-in-part of U.S. application Ser. No.13/490,745 filed Jun. 7, 2012, currently pending, which is acontinuation-in-part of U.S. application Ser. No. 12/642,058, filed Dec.18, 2009, which is now U.S. Pat. No. 8,224,348, issued Jul. 17, 2012,the content of both of which are hereby incorporated by reference intheir entirety.

TECHNICAL FIELD

The present invention relates generally to methods and apparatus forlocating wireless devices, also called mobile stations (MS), such asthose used in analog or digital cellular systems, personalcommunications systems (PCS), enhanced specialized mobile radios(ESMRs), and other types of wireless communications systems. Moreparticularly, but not exclusively, the present invention relates tousing location and identity information collected by wireless locationsystems (WLSs) and wireless communications networks (WCNs) to determinelocation, suspicious behaviors and then managing location generationresources based on location priorities, required quality of service andresource availability.

BACKGROUND

Location has always been a feature of mobile communications systems.With the advent of cellular radio systems, inherent in the functions ofthe wireless communications networks (WCNs) were the concepts of cell,sector, paging area and service area. These radio coverage areas createdwithin the WCN had a one-to-one correspondence to geographic areas, butwere of limited use in enabling location-based services outside of theprovision of communications between the mobile device and the WCN.

As part of the Personal Communications System (PCS) auction of 1994, theFederal Communications Commission, at the behest of public safetyagencies, added a requirement for the location of wireless emergencyservices calls for cellular and PCS systems. The FCC's wireless Enhanced9-1-1 (E9-1-1) rules were designed to improve the effectiveness andreliability of wireless 9-1-1 services by providing 9-1-1 dispatchersand public safety agencies with geographic location information onwireless 9-1-1 calls. Location accuracy varied from the E9-1-1 Phase Irules which required that the existing WCN developed locationinformation be converted to a geographic representation and madeavailable to public safety agencies. Phase II of the FCC E9-1-1 rulescalled for high-accuracy location of emergency services wireless calls.Eventually both network-based and mobile-based techniques were fieldedto satisfy the E9-1-1 Phase II high accuracy location mandate.

As realized and noted in extensive prior art, the ability to routinely,reliably, and rapidly locate cellular wireless communications deviceshas the potential to provide significant public benefit in public safetyand convenience and in commercial productivity. In response to thecommercial and governmental demand a number of infrastructure-based,handset-based and network-based wireless location systems have beendeveloped.

Infrastructure-based location techniques use information in use withinthe WCN to generate an approximate geographic location.Infrastructure-based location techniques include CID (serving Cell-ID),CID-RTF (serving cell-ID plus radio time-of-flight time-based ranging),CIDTA (serving cell-ID plus time-based ranging), and Enhanced Cell-ID(ECID, a serving cell, time-based ranging and power difference ofarrival hybrid). Signals that generate the WCN information that is theprecursor to infrastructure-based location may be collected at thehandset or at the base station and delivered to a mobile location serverwhich has databased knowledge of both the WCN topology and geographictopology.

Network-based location solutions use specialized receivers and/orpassive monitors within, or overlaid on, the wireless communicationsnetwork to collect uplink (mobile device-to-base station) signals, whichare used to determine location and velocity of the mobile device.Overlay Network-based techniques include uplinkTime-Difference-of-Arrival (TDOA), Angle-Of-Arrival (AOA), MultipathAnalysis (RF fingerprinting), and signal strength measurement (SSM).Examples of network-based systems for the determination of locations forwireless mobile units are found in Stilp, et al., U.S. Pat. No.5,327,144; Stilp, et al., U.S. Pat. No. 5,608,410; Kennedy, et al., U.S.Pat. No. 5,317,323; Maloney, et al., U.S. Pat. No. 4,728,959; andrelated art.

Mobile-device based location solutions use specialized electronicsand/or software within the mobile device to collect signaling. Locationdetermination can take place in the device or information can betransmitted to a landside server which determines the location.Device-based location techniques include CID (serving Cell-ID), CID-RTF(serving cell-ID plus radio time-of-flight time-based ranging), CIDTA(serving cell-ID plus time-based ranging), Enhanced Cell-ID (ECID, aserving cell, time-based ranging and power difference of arrivalhybrid), Advanced-Forward-Link-Trilateration (AFLT), Enhanced ObservedTime Difference (E-OTD), Observed-Time-Difference-of-Arrival (OTDOA) andGlobal Navigation Satellite System (GNSS) positioning. An example of aGNSS system is the United States NavStar Global Positioning System(GPS).

Hybrids of the network-based and mobile device-based techniques can beused to generate improved quality of services including improved speed,accuracy, yield, and uniformity of location. A wireless location systemdetermines geographic position and, in some cases, the speed anddirection of travel of wireless devices. Wireless location systems useuplink (device-to-network) signals, downlink (network-to-device)signals, or non-communications network signals (fixed beacons,terrestrial broadcasts, and/or satellite broadcasts). Network-basedlocation solutions use specialized receivers and/or passive monitorswithin, or overlaid on, the wireless communications network to collectsignaling used to determine location. Network-based techniques includeuplink Time-Difference-of-Arrival (TDOA), Angle-Of-Arrival (AOA),Multipath Analysis (RF fingerprinting), and signal strength measurement(SSM). Hybrids of the network-based techniques can be used to generateimproved quality of services including speed, accuracy, yield, anduniformity of location.

The use of collateral information supplied to the Wireless LocationSystem from the Wireless Communications Network or off-line databased toenable or enhance location determination in network-based systems wasintroduced in Maloney, et al., U.S. Pat. No. 5,959,580; and furtherextended in Maloney, et al., U.S. Pat. Nos. 6,108,555 and 6,119,013.These and related following descriptions of the prior art forinfrastructure-based location determination systems enable robust andeffective location-determination performance when adequate measurementdata can be derived or are otherwise available.

Since the advent of direct dial cellular telecommunications in 1984, andespecially in the past decade, the cellular industry has increased thenumber of air interface protocols available for use by wirelesstelephones, increased the number of frequency bands in which wireless ormobile telephones may operate, and expanded the number of terms thatrefer or relate to mobile telephones to include “personal communicationsservices,” “wireless,” and others. Also, data services, such asshort-message-service (SMS), packet data services (for example the GPRS(GSM General Packet Radio Service) and IP Multimedia Subsystem (IMS)have proliferated as has the number and variety of voice, data andvoice-data capable wireless devices.

The air interface protocols now used in the wireless industry includeAMPS, N-AMPS, TDMA, CDMA, TS-CDMA, OFDM, OFDMA, GSM, TACS, ESMR, GPRS,EDGE, UMTS, WCDMA, WiMAX, LTE, LTE-A and others.

The term CDMA will be used to refer to the CDMA digital cellular(TIA/EIA TR-45.4 defined IS-95, IS-95A, IS-95B), Personal CommunicationsServices (J-STD-008), and 3GPP2 defined CDMA-2000 and UMB standards andair interfaces. The term UMTS will be used to refer to the 3GPPspecified Wideband-CDMA (W-CDMA) based Universal MobileTelecommunications System, defining standards, and radio air interface.The term WiMAX is used to denote the IEEE defined 802.16, “BroadbandWireless”; 802.20, “Mobile Broadband Wireless Access”; and 802.22,“Wireless Regional Area Networks” technologies. The present inventionalso applies to the 3GPP defined Long-Term-Evolution (LTE) and the 3GPPLTE-Advanced (LTE-A) system among others.

For further background information relating to the subject matterdescribed herein, the reader may refer to the following patents andpatent applications assigned to TruePosition Inc., or TruePosition'swholly owned subsidiary, KSI: U.S. application Ser. No. 11/965,481entitled “Subscriber Selective, Area-based Service Control” (theentirety of which is hereby incorporated by reference) which is acontinuation-in-part of U.S. application Ser. No. 11/198,996 entitled“Geo-fencing in a Wireless Location System”, which is a continuation ofSer. No. 11/150,414, filed Jun. 10, 2005, entitled “Advanced Triggersfor Location-Based Service Applications in a Wireless Location System”,which is a continuation-in-part of U.S. application Ser. No. 10/768,587,filed Jan. 29, 2004, entitled “Monitoring of Call Information in aWireless Location System”, now pending, which is a continuation of U.S.application Ser. No. 09/909,221, filed Jul. 18, 2001, entitled“Monitoring of Call Information in a Wireless Location System,”, nowU.S. Pat. No. 6,782,264 B2, which is a continuation-in-part of U.S.application Ser. No. 09/539,352, filed Mar. 31, 2000, entitled“Centralized database for a Wireless Location System,” now U.S. Pat. No.6,317,604 B1, which is a continuation of U.S. application Ser. No.09/227,764, filed Jan. 8, 1999, entitled “Calibration for WirelessLocation System”, and U.S. Pat. No. 6,184,829 B1. Maloney, et al., U.S.Pat. No. 5,959,580; Maloney, et al., U.S. Pat. Nos. 6,108,555 andMaloney, et al., U.S. Pat. No. 6,119,013. Each of these is herebyincorporated by reference in its entirety.

SUMMARY

A Location Intelligence Management System (LIMS) is a data capture,storage and decision support system that utilizes available data (bothpast and real time) from multiple sources (such as wireless networks,wireless location network, and off line sources such as networkinformation, geographic information, manually entered information andgeo-spatial data) to optimize utilization (scheduling and selection) ofwireless location resources across multiple users and entities toproduce location-aware intelligence. The LIMS contains the algorithms,control logic, data storage, processors and input/output devices toanalyze past and real time data obtained from multiple sources incombination or separately, to produce intelligence in the form ofmetadata not otherwise reasonably or easily obtained. These algorithmscan iteratively use previous generated metadata to automaticallycontribute to new analysis, which will use both real data (past and realtime) as well as metadata. Such analysis would produce information suchas: identifying potential behaviors of interest, identifying specificmobile users associated with such behaviors of interest, associationsbetween mobile device users and mobile device user identification whenno public ID is available (such as with prepaid mobile devices). TheLIMS can then manage Position Determining Equipment (PDE) locationresource utilization based on a combination of factors including but notlimited to location priority, location accuracy, wireless locationsystem(s) capacity, the geographic distribution of PDEs, terrain,man-made information (known tunnels, buildings, bridges, etc.), networkinformation (cell distribution, coverage, network topology, networkstatus, etc.), for performing locations on traffic channels, controlchannels and data sessions.

In an illustrative embodiment, a LIMS comprises a controller computer, afirst database configured to store network event historical data, and asecond database configured to store metadata. The LIMS is configuredwith computer software to utilize data from multiple sources to producelocation-aware intelligence. This includes the creation of geo-profilesfor mobile devices. The geo-profiles include location and timeinformation for the mobile devices.

Such geo-profiles can be analyzed to detect aberrant or potentiallyaberrant behaviors, or what we refer to as “behaviors of interest,” or“behavior-based triggers”. For example, as described below, an aspect ofthis embodiment is the LIMS′ capability to detect behaviors of interestand identify specific mobiles or mobile users associated with suchbehaviors of interest. These behavioral complex triggers use the LIMScapabilities that allow radio or network events corresponding tospecific messages or groups of messages to generate high and/or lowaccuracy location estimates. A triggering event that initiates locationestimation may be a detection of a particular message or a field withina specific message. Over time, a database of historical informationincluding mobile identifiers and triggered events is developed(collection phase). The data collection phase may target any mobiledevice, any set of mobile devices, or a specific area in the wirelesscommunications network (WCN) service area. Selection of a mobile devicemay be by any of the detectable mobile or network identifiers associatedwith the mobile device. Data from the collection phase is then analyzedfor suspect behaviors and an index probability is assigned to eachmobile. The analysis phase may include information imported fromoff-line sources and may be performed periodically, ad hoc in responseto a set triggering event, or manually at any time.

Illustrative examples of advanced LIMS scenarios include urban and ruralsmuggling tunnel detection and location, and the identification andlocation of smuggling drop sites from smugglers using low-flyingaircraft. For example, in an illustrative embodiment, method for use bya wireless location system to detect unlawful border crossing activitiescomprises collecting data representing wireless device cellular events,where the data represents the locations of wireless devices as they areregistering with a wireless communications network and the times of thecellular events. In addition, the method comprises analyzing thecollected data representing wireless device cellular events in areasnear a border to identify a collection of cellular events associatedwith an unlawful border crossing. The data concerning network events mayinclude historical data and metadata, and the collection of cellularevents may comprise a cluster of cellular events occurring within adefined geographic area. The cluster of cellular events may be in thearea of a portal of an unlawful border crossing tunnel. Moreover, thecollection of cellular events may comprise a string of cellular eventsalong a flight path of an aircraft, wherein said flight path representsan unlawful border crossing. Additional aspects of the inventive subjectmatter are described below.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing summary as well as the following detailed description isbetter understood when read in conjunction with the appended drawings.For the purpose of illustrating the invention, there is shown in thedrawings exemplary constructions of the invention; however, theinvention is not limited to the specific methods and instrumentalitiesdisclosed. In the drawings:

FIG. 1 schematically depicts a high level LIMS system in relation toother system nodes.

FIG. 2 illustrates functional subsystems of the LIMS system.

FIG. 3 depicts an example LIMS campaign.

FIG. 4 a depicts the direct location of a tunnel mouth in a rural areaby mobile device emissions.

FIG. 4 b depicts the indirect location of a tunnel mouth in a rural areaby mobile device emissions.

FIG. 5 depicts locating a tunnel opening in an urbanized area.

FIG. 6 depicts the detection and location of a low-altitude aerialsmuggling drop.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

We will now describe illustrative embodiments of the present invention.First, we provide a detailed overview of the problem and then a moredetailed description of our solutions.

FIG. 1, High Level LIMS System

FIG. 1 illustrates the LIMS as deployed in a generic wirelesscommunications Network (WCN). The Radio Access Network (RAN) 101provides the radio link between the mobile device and the Core Network102. Examples of a RAN network can include the Global System forMobility (GSM), iDEN, Tetra, Universal Mobile Telephone System (UMTS),WiMAN, WiMAX, Long-Term-Evolution (LTE), Generic Access Network (GAN),and the IS-95/IS-2000 family of CDMA protocols among others. The CoreNetwork provides the basic switching, routing, transcoding, metering,and interworking needed to connect and bill mobile-to-land,land-to-mobile, and mobile-to-mobile connections. The core networkconnects to landside networks and other mobile networks via the PublicInterconnection Network 103 (nominally a SS7 network with trunking forcircuit switched connections or a TCP/IP network for digital packet dataconnections.

The LIMS 108 subsystem is connected to the RAN 101 and Core Network 102via the Link Monitoring System (LMS) 106. As disclosed in TruePositionPatents No. 6,782,264, Aug. 24, 2004, “Monitoring of Call Information ina Wireless Location System,” and U.S. Pat. No. 7,167,713 “Monitoring ofCall Information in a Wireless Location System” and then expanded inU.S. Published Patent Application 20060003775, filed Jun. 10, 2005,“Advanced Triggers for Location-based Service Applications in a WirelessLocation System,” an Abis Monitoring System (AMS) or Link MonitoringSystem (LMS) 106 can be deployed in conjunction with the wirelesslocation system to supply a passive means of triggering and tasking thewireless location system. As cost savings measures, an LMS 106 may bedeployed to monitor the Abis (BTS-to-BSC) link only or the required LMSfunctionality may be incorporated directly into the BSC. Fullfunctionality of the LMS in identifying wireless transactions, networktransactions, mobile identifiers, and subscriber identifiers requiresthat the example GSM network, the A, Abis, and GSM-MAP interfaces, bemonitored. The LMS 106 functionality can be deployed as a network ofpassive probes reporting back to a central server cluster or as asoftware-based application for inclusion in wireless infrastructure, forexample, the Base Station Controller (BSC) or Radio Network Controller(RNC). The LMS 106 connects to the RAN 101 via a digital data connection104 and to the Core Network 102 via a digital data connection 105. TheLMS 106 connects with the LIMS 108 via a digital data connection 111.The LMS 106 may optionally connect with the Position Determining Entity114 via a digital data connection 115 in cases where triggers andfilters, and priorities pre-set in the LMS 106 by the LIMS 108 require aminimum latency in initiation of the location signal collection andcalculation.

The LIMS 108 is a set of generic computer servers and routers runningspecialized interconnected software applications and databases. The LIMS108 connects via digital data links 112 113 to multiple databases whichat minimum include a network event historical database 110 and ametadata database 109. The LIMS 108 is a decision support system thatdetermines when and how accurate a specific wireless location needs tobe and where to best obtain it from given current conditions (forexample, how busy different PDEs are or the concentration of concurrentrequests for locations in a given geographic area). The LIMS thenmanages PDE 114 location resource utilization based on a combination offactors including but not limited to: priority, accuracy, system(s)capacity, geographic distribution of PDEs, terrain, man-made information(such as, known tunnels, buildings, bridges), network information (celldistribution, coverage, network topology, network status), forperforming locations on traffic channels, control channels and datasession locations. Information on man-made features may includeelevation and altitude data. Man-made features include transportationstructures (bridges, overpasses, tunnels) as well as industrial andhabitable structure information.

The LIMS 108 manages location resources based on prioritization level,resource availability, and demanded location quality of service. TheLIMS 108 contains a decision support system (DSS) software applicationto automatically decide when to require a high accuracy location versusa lower accuracy location which does not require potentially limited PDE114 location resources. The DSS application uses rules, databasedlocation, identity, and transactional information (network or mobileevents, time of day, geo-fence boundaries) to determine a set ofscenarios based on a prioritized set of situational issues that generatemetadata (which is stored in a metadata database) such as relationshipsbetween users, mobile devices, locations of interest and other mobiledevices. Using the multidimensional histograms of activity and locationswith dynamic conditional logic, the LIMS can determine association byproximity which can then be used as a triggering event or use locationas a proxy to identity (metadata) users and relationships between users,groups and locations of interest. In setting the automatic real-time,high-accuracy location of mobile devices, the metadata analysis is usedby the DDS application to compile an iterative, “Risk profile”,escalating number on accumulation of weighted patterns and factors foreach device, Mobiles with a high risk threshold, as determined bybehaviors e.g. such as entry or exit to secured areas, communicationwith or proximity to known suspects, or communication patternsindicative of known avoidance patterns, are subjected to additionalscrutiny and potentially flagged to users.

The LIMS 108 receives infrastructure-generated tasking information enmass from the LMS 106 to obtain data for real time processing ofcurrently running algorithms, to populate the network event historicaldatabase 110 for future analysis as well as details required to enablethe network based location system (PDE) to perform higher accuracylocations as required. The network event historical database 110contains all events from all “simple” triggers set in the LMS, theseevents include mobile identifiers (such as IMSI, IEMI, MS-ISDN, TMSI,MSIN, GUTI, M/S-TMSI/IMEI-SV, C-RNTI) event details (such as callednumber, calling number, message type) as well as location informationgleaned from the wireless network parameters obtained from the eventreports. The LIMS 108 creates its own complex triggers from thecombination of the real time flow of mass data into the operatingalgorithms, use of past network event historical data 110 and pastmetadata database 109 and use of the DSS that optimized PDE utilizationpreviously mentioned.

Examples of the LIMS 108 capabilities enabled by the network eventhistorical database 110 include geo-profile (locations and events as afunction of time, probability and pattern analysis) determination,associations by proximity (correlation between two or more devices basedon location proximity as a function of time and based on probability andpattern analysis in consideration of accuracy and other factors) basedon histograms and conditional logic, detection of past patterns ofevasive behavior (such as SIM swapping, use of multiple SIMs by the sameuser, use of multiple phones carried by the same user, turning mobiledevices on only briefly, turning mobile devices off and on at specificlocations frequently). The LIMS 108 can use a mobile's calling patternand history for analysis, but more importantly, it can use non-callrelated information such as registrations and location updates foradditional analysis to build improved geo-profiles and associations byproximity to then recognize suspicious behavior and events. (Suchnon-call related information, including registrations and locationupdates, are included within the term “cellular events” as that term isused herein.) The network event historical database 110 includes recordson both messaging-related and WCN control events like location updates,handovers, power up IMSI attaches and power down de-registrations).Additionally, information from the metadata database 109 (containingnon-wireless, non-transmitted or generated information) can be also beused in the decision matrix. For example, user entered information ongeographic areas of interest, known special terrain conditions orspecific case information can be used to add additional intelligence forfiltering and correlative analysis. Additionally, the metadata database109 contains data generated from past execution of algorithms (such asgeo-fence operations, targeted surveillance activity) is maintained andcan be used.

A geo-profile is created for each mobile device and will include thelocation of the mobile as a function of time for a specific time rangeor area of interest. Such geo-profile is metadata that is created fromnetwork transactions (single to multiple) monitored by the LIMS platformas well as from off-line sources and LIMS created meta-data derived frompost-processing analysis and multi-transaction complex triggers. When ageo-profile of a mobile is focused on a specific area of interest, thisis called a geo-fence profile.

For instance, a geo-fence profile can include where a mobile spent timein or out of a specific geographical area is recorded as a function oftime, or as a time value as a function of area.

For each network transaction monitored, a network transaction record(NTR) is created and appended to the geo-profile. Analysis of thecontents of the NTR may be in real-time or performed in apost-processing stage. The timing and priority of analysis may be basedon any field in the NTR. Results of the analysis are then added to thegeo-profile.

An example of the NTR is shown in Table 1 and illustrative details ofthe record are shown in Table 2. Exact details of the NTR contents aredependent on the probe system deployed. For instance, a wirelesscommunications network based software-based probe (located in the GSMBase Station Controller, the UMTS Radio Network Controller, or the LTEServing Gateway Mobility Management Entity) may deliver differentinformation then a passive overlay/independent probe network.

TABLE 1 Network Transaction Record TS ID KEY TRIG EV Cell EXT LOC GEORISK

TABLE 2 Network Transaction Record Detail TS—this is the timestamp datafor the triggering event ID—this is the collected identificationinformation for the mobile device (e.g. MSISDN, IMSI, IMEI, TMSI)KEY—Any information for the network transaction that includes EncryptionKey data (either collected by or delivered to the LIMS) TRIG—The indexto the triggering event EV—The Event(s) descriptor and details. This isin addition to the triggering information and can include called number,calling number, location area CELL—this field includes data about thewireless communications network. Example data includes serving Cell ID,Serving Cell Location, Serving Network Name, Network ID, Country Code,Country, Wireless Operator technology, and available LocationTechnology. EXT—Extended information on WCN radio link such as timingparameters (e.g. Timing advance, Round Trip Time or Serving-One-Way-Delay) and link power (e.g. Measurement Reports, NetworkMeasurement Reports, Code Power Measurements, or Pilot StrengthMeasurements). Both uplink and downlink information on the radio linkLOC—When a location is triggered, the Mobile Device location, velocityand uncertainties for location and velocity are stored. GEO—Includesgeo-fence information if mobile is interacting with a set Geo-fence areaor boundary. This field includes Geo- Fence Name, Geo-fence breach,breach direction, Breach Type, Breach Frequency, Breach time. RISK—Arisk parameter is set for each mobile device and is set on the basis ofeach event, and each geo-fence. This field is incremented anddecremented in accordance to the rules and priorities set by the LIMSoperator.

In the U.S. Pat. No. 7,783,299, issued Aug. 24, 2010, entitled “AdvancedTriggers for Location-Based Service Applications in a Wireless LocationSystem”, TruePosition introduced the basic concept of triggers allowingfor the monitoring of WCN for events and transactions that wouldautomatically cause a location attempt based on the pre-set triggers.Use of the LIMS 108 with its decision support system (DSS) andhistorical and metadata database(s) enable a new class of triggers basedon an additional layer of logic and filtering based on historical oroff-line data. The basic trigger delivered information and other data isprocessed by the DSS with a set of if-then-else rules combined withdatabased information on events, time-of-day, and geo-fence boundariesto create a database of metadata. The newly created metadata allows theLIMS to perform analysis where the location of a mobile is used as aproxy to identity, purpose and relationships with other mobile users.The same metadata can be used to enhance forward looking algorithmswhich in turn produce new complex triggers.

An example of a complex trigger than uses network event historicaldatabase 110 in conjunction with real time network information is a whentwo or more mobile devices exhibit the same location behavior over aperiod of time, such as being co-located while moving around for periodsof time, implying they are traveling together, but there is noinformation in the historical database indicating they ever interactwith each other (e.g. voice call, connection via data session orShort-Message-Service (SMS)). Then, the LIMS can decide to utilize highaccuracy PDE resources to further verify or dispute this heuristicinformation. Such high accuracy locations would be based on real timenetwork events, either passive or actively generated to determinelocation of said subjects at the same point in time. This can remain inoperation for extended periods of time to increase confidence in thecorrelation.

Another example is the automatic detection of SIM swapping based onhistorical data as compared to the real time data coming in from thenetwork. Once detected, the LIMS can then decide to trigger the PDE tolocate the mobile(s) using high accuracy at that point in time or on acontinuous basis depending on the user conditions set up in the LIMSsuch as location area where this occurs, time and day constraints,proximity to other known mobile devices, etc. Automatic use of highaccuracy location helps build up a set of high accuracy information inthe metadata database for a set of high risk mobile devices and theirusers for future correlation with other mobile devices, public events(such as crimes, public gatherings, etc.) sites and points of interest(such as tunnel entry/exit point, overlook observation points) as thehigh accuracy resources are limited and cannot be provided for everymobile and every network event.

Network Event historical database 110 (may actually be one or moredatabases) contains information on every network event transaction thatoccurs in the covered area for all mobile devices as configured. Thiscould be reduced to a specific set of mobile devices via a list ofidentifiers for inclusion only or exclusion only. Said database containsselected information for each event including all available knownidentifiers of the specific mobile (one or more of the following: TMSI,IMSI, IMEI, MSISDN). It also includes event related informationincluding the event type (such as hand over, mobile originated call, SMSreceived, etc.) and related event data such as dialed digits andtimestamps. Additionally, each event contains relevant networkinformation depending on the network type (cell site and TA for GSM, CIand SAI for UMTS, etc.). The network event historical database alsoincludes some metadata for each specific event (not related to otherevents or combinations) which includes a calculated X, Y location basedon best available location processing (including high accuracy) as wellas additional identifiers populated (such as MSISDN) that may not haveactually existed in the network event but are known to belong to thesaid mobile device through correlation previously provided in the LMS orLIMS.

Metadata database 109 (may actually be one or more databases) containsinformation that is input by users (manually or automatically) andinformation that is produced as a result of processes or algorithms onthe LIMS 108. User input data can contain maps information including butnot limited to streets, terrain, clutter, buildings, foliage, tunnels,pipelines, facilities (airports, bases), sites or areas of interest(such as buildings or border crossings points or geo-fence definitions),can also contain network information including but not limited to cellsite locations, antenna sizes, azimuths, directions, down tilt, caninclude high accuracy location results for specific algorithms that haverun in the past (such as geo-fence operations or surveillanceoperations) as well as specific information related to conditions andparameters used in past algorithm runs.

FIG. 2, Exemplary LIMS Network

FIG. 2 details an example of the LIMS network. In this example, the LinkMonitoring Systems 201 202 are separate from the LIMS deployment 200,although in practice, the functionality could be combined on the sameserver platform or cluster of servers. The LIMS and LMS are deployed ina 1-to-1 or 1-to-many configuration based on needed capacity, number ofwireless carriers to monitor, or geographic service area.

The LIMS controller 203 uses generic digital data interconnections tothe LMS platforms 201 202. The controller 203 is both a packet router aswell as a firewall providing authentication and access control. As partof the router function the controller 203 performs event scheduling,packet filtering and inter-subsystem communications. Provisioning,monitoring and control of the LMS network 201 202 is also performed viathe controller 203 communications interfaces 211 212. Said controller203 also contains the aforementioned control logic and algorithms forgenerating complex triggers and may be a single or cluster of servers.

The controller 203 directs LMS obtained wireless network transactioninformation to database 204 via a high speed database interface 213.Additional information such as high-accuracy location, association data(metadata), and sensor fusion (such as image recognition, photos,videometric identity) data may be stored on additional databases 205that may be remotely housed or internal to the LIMS deployment 200 (asshown). The interface 214 to the other databases 205 is dependent ondeployment specifics but can take the forms of any of a number oflocal-area-network (LAN), wide-area-network (WAN) or database specificinterfaces.

The controller 203 allows for recovery of databased wireless networktransaction information from the database 204 via 213 via the genericEthernet interfaces 222 218 which interconnect the local user stations210 and remote user stations 207.

The LIMS deployment's Local Area Network 217 offers packet dataconnectivity to all subsystems under the controller's 203 rules. Thecontroller connects to the LAN 217 via Ethernet 216 as does the internallocation-based services applications server 209 via link 219 and the Mapdatabase 208 via data link 220.

The local user stations 210 and remote user stations 207 via thecontroller 203 and the associated packet data network 217 have access tothe databased wireless information 204, but also internal location-basedservices applications 209, external location-based services applications206 and digital mapping database(s) 208. The external applications 206and remote user stations 207 interconnections 215 and 216 may take theform of a variety of transport links which are translated by the Bridge223. The Bridge 223 also supports additional authentication, accesscontrol, monitoring, and intrusion security for the external or remotecomponents 206 207.

Over time, a database of historical information is developed (collectionphase) of mobile identifiers and triggered events. The data collectionphase may target any mobile device, any set of mobile devices, or aspecific area in the wireless communications network (WCN) service area.Selection of a mobile device may be by any of the detectable mobile ornetwork identifiers associated with the mobile device.

Data from the collection phase is then analyzed for suspect behaviorsand an index probability is assigned to each mobile. The Analysis phasemay include information imported from off-line, non-wireless sources.The Analysis phase may be performed automatically periodically, ad hocin response to a set triggering event, or manually at any time.

Illustrative Examples of Advanced LIMS scenarios

These illustrative examples are used to highlight the capabilities ofthe LIMS. Either network-based (U-TDOA, AoA, ECID) or mobile-based(A-GNSS, GNSS, OTDOA, ECID) wireless location techniques may be used toaccomplish geo-location of mobile devices. Selection of the wirelesslocation technique may be based on the mobile device's capabilities, theserving wireless communication network's capabilities or the operator'sdiscretion. The use of network-based techniques is of an advantage whenlocating mobile devices in buildings since radio link power-control onthe mobile device can overcome attenuation from the surroundingstructure versus fixed power broadcasts such as those from orbitingsatellites.

Another aspect of the LIMS capability is in the detection of behaviorsof interest and identifying specific mobiles or mobile users associatedwith such behaviors of interest. These behavioral complex triggers usethe LIMS capabilities, such as, e.g., the previously cited U.S. Pat. No.7,783,299, “Advanced Triggers for Location-based Service Applications ina Wireless Location System,” that allow for radio or network events(corresponding to specific messages or groups of over-the-air,inter-network or intra-network messaging) to generate high and/or lowaccuracy location estimates. A triggering event, one that initiateslocation estimation, may be a detection of a particular message or afield within a specific message. Examples of detectable network or radioevents (also called network transactions) in a wireless communicationsnetwork include: (1) Mobile originations/terminations; (2) SMSoriginations/terminations; (3) Mobile Attach/Detach (packet data)events; (4) Registration/Location/Routing Update (that is, a “location”update for the purposes of mobility and roaming as opposed to anetwork-based (U-TDOA, AoA, ECID) or mobile-based (A-GNSS, GNSS, OTDOA,ECID) location event; (5) Handovers; and (6) Call Releases.

FIG. 3, LIMS Campaign

FIG. 3 shows the high level procedural flow for a LIMS campaign. Asdescribed in U.S. Pat. No. 8,224,348 issued Jul. 17, 2012, includedherein via reference, a Location Intelligence Management System (LIMS)is a data capture, storage and decision support system that utilizesavailable data (both past and real time) from multiple sources (such aswireless networks, wireless location network, and off line sources suchas network information, geographic information, manually enteredinformation and geo-spatial data) to optimize utilization (schedulingand selection) of wireless location resources across multiple users andentities to produce location-aware intelligence. The LIMS contains thealgorithms, control logic, data storage, processors and input/outputdevices to analyze past and real time data obtained from multiplesources in combination or separately, to produce intelligence in theform of metadata not otherwise reasonably or easily obtained. Thesealgorithms can iteratively use previously generated metadata toautomatically contribute to new analysis, which will use both real data(past and real time) as well as metadata. Such analysis would produceinformation such as: identifying potential behaviors of interest,identifying specific mobile users associated with such behaviors ofinterest, associations between mobile device users and mobile deviceuser identification when no public ID is available (such as with prepaidmobile devices). The LIMS can then manage Position Determining Equipment(PDE) location resource utilization based on a combination of factorsincluding but not limited to location priority, location accuracy,wireless location system(s) capacity, the geographic distribution ofPDEs, terrain, man-made information (known tunnels, buildings, bridges,etc.), network information (cell distribution, coverage, networktopology, network status, etc.), for performing locations on trafficchannels, control channels and data sessions.

As described in U.S. patent application Ser. No. 13/490,745, filed: Jun.7, 2012, included herein via reference, the LIMS may be furtherconfigured with computer software to utilize data from multiple sourcesto produce location-aware intelligence including the creation ofgeo-profiles for mobile devices. The geo-profiles include location,event, and time information for the mobile devices.

Such geo-profiles can be analyzed to detect aberrant or potentiallyaberrant behaviors, or what we refer to as “behaviors of interest,” or“behavior-based triggers”. For example, as described below, an aspect ofthis embodiment is the LIMS′ capability to detect behaviors of interestand identify specific mobiles or mobile users associated with suchbehaviors of interest. These behavioral complex triggers use the LIMScapabilities that allow radio or network events corresponding tospecific messages or groups of messages to generate high and/or lowaccuracy location estimates. A triggering event that initiates locationestimation may be a detection of a particular message or a field withina specific message. Over time, a database of historical informationincluding mobile identifiers and triggered events is developed(collection phase). The data collection phase may target any mobiledevice, any set of mobile devices, or a specific area in the wirelesscommunications network (WCN) service area. Selection of a mobile devicemay be by any of the detectable mobile or network identifiers associatedwith the mobile device. Data from the collection phase is then analyzedfor suspect behaviors and an index probability is assigned to eachmobile. The analysis phase may include information imported fromoff-line sources and may be performed periodically, ad hoc in responseto a set triggering event, or manually at any time. Illustrativeexamples of advanced LIMS scenarios include area presence determination,association by proximity, detection of avoidance tactics, and generalsurveillance using secondary triggers.

The first stage of an active LIMS campaign 305 is Setup 301. The Setup301 includes deployment of a LIMS system to cover the area of interestwithin the service area of a wireless communications network (WCN). TheLIMS deployment options include standalone deployment, co-deploymentwith a Wireless Location System (WLS) and/or monitoring probes withinthe carrier infrastructure, and interconnection to the carrier network'sadministration or command and control framework. Although nominallydeployed with a first WCN, a LIMS and associated wireless probes may beused to monitor radio events in geographically overlapping orneighboring WCN.

In data collection 302, the WLS, a network of wireless receivers and/orwired probes, provides the LIMS system with call-related data to build adatabase of events over time. Non-call related information (e.g. radionetwork information, geographic information, geo-spatial data, andmanually entered information such as points of interest or timed/datedevents) is also provided to the LIMS.

Data Collection 302 may also include the entry of additional historicalcall data loaded into LIMS from the wireless carrier'(s) Home LocationRegister (HLR), Home Subscriber Server (HSS), Billing records, calldetail Records database(s) or other call/caller related information suchas that retained for production in law enforcement requests for calldata. Loading of such historical data could be used to extend the LIMSdatabase in time or in coverage, or to configure the LIMS for use in astandalone deployment.

Once call information is being gathered or loaded, the LIMS can beginanalyzing the call data. In the data evaluation 303, a set of rules foranalysis of the data is entered. The combination of call data, filterssuch as geo-fences and time-of-day are used to build complex triggersthat, when then used with off-line data 307, is then used to createmetadata for each call or caller. The newly created metadata allows theLIMS to perform analysis where the location of a mobile is used as aproxy to identity, purpose and relationships between mobile users. Thesame metadata can be used to enhance forward looking algorithms which inturn produce new complex triggers which then can be used for furtheranalysis.

When, during evaluation 303, the rules for analysis flag a call, caller,or group of calls, a response 304 is called for. This response 304 maybe customized and prioritized, e.g. the response could be an alarm tothe operator terminal, generation of an ad hoc report, generation ofentry in a periodic report, or an immediate real-time automated responsedependent on the level of integration between the LIMS and non-LIMSsystems.

Once the active campaign 305 has ended, the results of the evaluation303 (the rule set, metadata, generated triggers) and any data generatedin the response 304 may be stored as offline data in a database 307 forlogging or reuse in later campaigns.

FIG. 4 a, Location of Tunnel Portal

FIG. 4 a illustrates a rural scenario for location of a tunnel portal.An international border 401 exists between relatively uninhabited areasof separate countries. A road 402 roughly parallels the border. Noofficial border crossings exist in the local area. The border 401 iswalled or fenced or under continuous surveillance by cameras or othersensors. The local Wireless Communications Network (WCN) provides radiocoverage 409 over the second, near side tunnel mouth 405.

A first, far side tunnel mouth 403 has been dug and a border-crossingtunnel 404 constructed with the second portal 405 on the other side ofthe border 401. The tunnel mouths 403 404 have been concealed bycamouflage, vegetation, or dug out so terrain features preclude easyobservation from the road 402.

Under observation of the LIMS system, collection and analysis of radionetwork transaction information from the area is performed. Forinstance, registrations, SMS, call originations/terminations, datatransfers, attachment events, and control messaging may all be observed.In this example, registrations from mobile devices emerging from thetunnel 404 are noted and located to high precision. The LIMS PDEreceivers can be placed so as to maximize the precision over a localarea. The LIMS PDE receivers can also be tuned to receive registrationsfrom over the border 401 and determine and locate a second cluster ofregistrations on the foreign WCN if the tunnel mouth 403 is being usedas an exit.

The resulting cluster of registrations 407 408 can then be used tolocate the tunnel mouths 403 405. By using a threshold for registrationsas well as time-of-day, weather conditions, seasonality, or geology,false positives can be reduced. Over time, even solitary power-upregistrations 406, not associable to a cluster 405 can accumulate andlead to tunnel mouth discovery.

FIG. 4 b, Alternate Scenario for Location of Tunnel Portal

FIG. 4 b illustrates an alternate rural scenario for location of atunnel portal. An international border 401 exists between relativelyuninhabited areas of separate countries. A road 402 roughly parallelsthe border 401. No official border crossings exist in the local area.The border 401 is walled or fenced or under continuous surveillance bycameras or other sensors.

A first tunnel mouth 403 has been dug on the far side of the border anda border-crossing tunnel 404 constructed with the second mouth 405 onthe near side of the border 401. The tunnel mouths 403 405 have beenconcealed by camouflage, vegetation, or dug out so terrain featurespreclude easy observation from the road 402.

The local Wireless Communications Network (WCN) does not provide radiocoverage 409 over the second tunnel mouth 405 but does cover the nearbyroadway 402 with radio coverage 409. Once idle mobile devices come intothe coverage area 409, they quickly attempt to register with the localWCN. The non-local WCN (not shown) on the far side of the border doesnot provide coverage to the area over the border.

Under observation of the LIMS system, collection and analysis of radionetwork transaction information from the area is performed. Forinstance, registrations, SMS, call originations/terminations, datatransfers, attachment events, and control messaging may all be observed.In this example, registrations from mobile devices entering the coveragearea 409 are noted and located to high precision. The resulting clusterof registrations 407 can then be used to assist in the location of thesecond tunnel mouth 405. By using a threshold for registrations as wellas time-of-day, weather conditions, seasonality, or geology; falsepositives can be reduced. Over time, even solitary power-upregistrations 406 from mobiles devices turned off before leaving thetunnel 404, not associable in real-time to a cluster 405 can accumulateand lead to localization of a trail that leads to a tunnel mouth 405.

FIG. 5, Location of Tunnel Mouth in Urban Area

FIG. 5 is a sequential illustration of the location of tunnel mouthusing LIMS in an urbanized area. In this illustrative scenario, a bordercrossing tunnel 501 has been dug between a first 506 and second 508buildings going underneath the border 502 and border defenses 503. Thebuildings provide concealment of the first tunnel mouth 514, the secondtunnel mouth 513 as well as any digging equipment, extracted soil,people and/or smuggled (or to-be-smuggled) goods.

The border control in this example scenario is already enforced by aborder wall 503. A monitored border crossing 504 is served by a road andhighway network 517 interconnecting both sides of the border. DistinctWireless Communications Networks (WCNs) serve each side of the borderwith no or minimal cross-border coverage.

This urban scenario is complicated by the presence of buildings 505 506on the first, far side of the border 502 and multiple buildings 507 508516 on the second, near side of the border 502

Deploying and configuring a LIMS system with associated high-accuracyWLS to cover the area, a campaign collecting all call and caller data isperformed. A geo-fence is constructed to detect entry into the area onthe second, near side of the border. The geo-fence uses the availablegeo-spatial information determined from the wireless networkconfiguration and use (cell, cell/sector, cell/sector and power,cell/sector and timing, cell/sector timing and power). For the areaunder observation of the LIMS system, collection and analysis of radionetwork transaction information from the area is performed. Forinstance, registrations, SMS, call originations/terminations, datatransfers, attachment events, and control messaging may all be observed.

To detect the second, near side tunnel mouth 513, the LIMS initiallyuses location registrations (also known as paging area updates, routingarea updates, tracking areas updates). Collecting and locatingregistrations, the LIMS removes those 512 geographically associated withthe legitimate border crossing 504. A second cluster of registrations515 is found. An initial evaluation finds the prevalence ofregistrations, initial attachment messaging and lack of previous entryinto the LIMS database raising the risk metric for these phones and thebuilding 516 geographically associated with the cluster 515. However;upon evaluation with off-line data, the cluster 515 was found to beassociated geographically with a wireless carrier store and thereforeremoved from consideration. Non-clustered registrations 510 are notedand kept for further, future evaluation.

In one specific cell 509 of the geo-fenced area, a cluster ofregistrations 511 was located. Upon evaluation, it was found that manyof the mobile devices were new to the LIMS database and registrationincluded attachment messaging. Based on the evaluation, the building 508geographically associated with the suspicious cluster 511 was reportedfor observation and potential searches for the tunnel mouth 511 and anysmuggled goods or people.

FIG. 6, Over the Border Airdrop Detection

FIG. 6 geographically illustrates over the border airdrop detectionusing LIMS. Under observation of the LIMS system, collection andanalysis of radio network transaction information from the area isperformed. For instance, registrations, SMS, calloriginations/terminations, data transfers, attachment events, andcontrol messaging may all be observed.

In FIG. 6, an over-the-border incursion by a light aircraft (e.g. anultralight aircraft) is depicted. In this illustrative scenario, theborder 601 is wall, fenced, patrolled or otherwise under observation.Smugglers use light aircraft and commercial wireless communications(e.g. cell phones) to smuggle goods over the border 601. The aircraft604 follows a flight path 605 that stays comparatively low to theground, under-the-radar, to prevent detection.

Upon entering 606 the coverage area 603 of the local base station 602,the mobile device carried by the pilot registers with the local WCN. Theregistration 606 is noted and located by the LIMS's PDE component. Thelocation data (which includes speed, bearing and potentially altitude)allows LIMS to classify the mobile device as an aerial incursion (forinstance, map data shows proximity to the border 601 and no road surfaceassociated with the location, speed and bearing).

The LIMS then uses the real-time connection to the WCN network (forinstance via a Mobile Positioning Center (MPC), Gateway Mobile LocationCenter (GMLC) or similar facility) and the highest accuracy wirelesslocation system available to ping the Mobile-device-Of-Interest (MOI)(e.g. using AnytimeInterrogation (ATI), null SMS, or wirelessnetwork-technology specific silent messaging mechanism). Repeated pingsof the MOI allow repeated high accuracy locations 607 and plotting ofthe flight. The furthest incursion area 609 is noted based on the flightplot and in this scenario, the proximity to a road. The LIMS notes thefurthest incursion area 609 and continues to ping the MOI untilcommunications is lost.

Using call data for the serving cell 602, the LIMS searches its databasefor a call between the MOI and any other mobile device. In thisscenario, a second MOI 608 is discovered in the area and as being thesender of a call (or messaging) to the first, aerial MOI. Based on thatcall and the proximity to the predicted drop zone 609, the second MOI608 is flagged for further tracking and reporting.

Using the over-the-border and cross-network capabilities of the LIMS andWLS, a registration event 610 of the aerial MOI may be detected andlocated over the border.

CONCLUSION

The true scope the present invention is not limited to the presentlypreferred embodiments disclosed herein. For example, the foregoingdisclosure of a presently preferred embodiment of a Wireless LocationSystem uses explanatory terms, such as LMS (Link Monitoring System), RNM(Radio Network Monitor), Serving Mobile Location Center (SMLC), LocationMeasuring Unit (LMU), and the like, which should not be construed so asto limit the scope of protection of the following claims, or tootherwise imply that the inventive aspects of the Wireless LocationSystem are limited to the particular methods and apparatus disclosed.Moreover, as will be understood by those skilled in the art, many of theinventive aspects disclosed herein are based on software applicationsrunning on generic hardware processing platforms and may be combinedinto the radio access network platforms such as the radio base station(e.g. the enhanced NodeB (eNB)) or into the Evolved Packet Core (EPC)entities such as the Mobility Management Entity (MME). These functionalentities are, in essence, programmable data collection and processingdevices that could take a variety of forms without departing from theinventive concepts disclosed herein. Given the rapidly declining cost ofdigital signal processing and other processing functions, it is easilypossible, for example, to transfer the processing for a particularfunction from one of the functional elements (such as the LIMS)described herein to another functional element (such as the PDE) withoutchanging the inventive operation of the system. In many cases, the placeof implementation (i.e., the functional element) described herein ismerely a designer's preference and not a hard requirement. Accordingly,except as they may be expressly so limited, the scope of protection ofthe following claims is not intended to be limited to the specificembodiments described above.

What is claimed:
 1. A location information management system (LIMS),comprising: a controller computer; and one or more databases operativelycoupled to the controller computer and configured to store dataconcerning network events; wherein the LIMS is configured to utilize thedata concerning network events to produce location-aware intelligenceincluding geo-profiles for mobile devices, wherein said geo-profilesinclude location and time information for said mobile devices; andwherein the LIMS is further configured to detect unlawful bordercrossing activities by: (a) collecting data representing wireless devicecellular events, said data representing the locations of wirelessdevices as they are registering with a wireless communications network(WCN) and the times of the cellular events; and (b) analyzing thecollected data representing wireless device cellular events in areasnear the border to identify a collection of cellular events associatedwith an unlawful border crossing.
 2. The LIMS recited in claim 1,wherein the data concerning network events includes historical data andmetadata.
 3. The LIMS recited in claim 1, wherein the collection ofcellular events comprises a cluster of cellular events occurring withina defined geographic area.
 4. The LIMS recited in claim 3, wherein thecluster of cellular events is in the area of a portal of an unlawfulborder crossing tunnel.
 5. The LIMS recited in claim 1, wherein thecollection of cellular events comprises a string of cellular eventsalong a flight path of an aircraft, wherein said flight path representsan unlawful border crossing.
 6. The LIMS recited in claim 1, wherein theLIMS is configured to be coupled to a link monitoring system (LMS), andto store wireless network transaction information obtained by the LMS,and to store additional information including high-accuracy locationdata, association data, and sensor fusion data.
 7. The LIMS recited inclaim 6, wherein the sensor fusion data includes at least one of: imagerecognition data, photographic data, and videometric identity data. 8.The LIMS recited in claim 1, wherein the LIMS is further configured to:analyze data to produce intelligence in the form of metadata, and tostore the metadata; and iteratively use previously generated metadata tocontribute to new analysis, wherein said new analysis producesinformation including at least one of: identification of potentialbehaviors of interest, identification of specific mobile usersassociated with said behaviors of interest, associations between mobiledevice users, and mobile device user identification.
 9. The LIMS recitedin claim 1, wherein the LIMS is further configured to use datarepresenting activity and locations to determine association byproximity.
 10. The LIMS recited in claim 1, wherein the LIMS is furtherconfigured to use location as a proxy to identify users andrelationships between wireless device users and locations of interest.11. The LIMS recited in claim 1, wherein the one or more databasescontain(s) mobile identifiers including IMSI, IMEI, MS-ISDN, and TMSIidentifiers, event details including called number, calling number, andmessage type, and location information.
 12. The LIMS recited in claim 1,wherein the LIMS is further configured to use a mobile device's callingpattern and history for analysis, and to use non call-relatedinformation, including registrations and location updates, to recognizesuspicious behavior and events.
 13. The LIMS recited in claim 1, whereinthe one or more databases include(s) records on both messaging-relatedand wireless communications network control events including locationupdates, handovers, power up IMSI (International Mobile SubscriberIdentity) attaches, and power down de-registrations.
 14. The LIMSrecited in claim 1, wherein the LIMS is further configured to store insaid one or more databases information from multiple sources, includinga wireless network, a wireless location network, and off-line sourcesproviding network information, geographic information, manually enteredinformation and geo-spatial data.
 15. The LIMS recited in claim 1,wherein the LIMS is further configured to detect predefined behaviors ofinterest and to identify specific mobile devices or mobile usersassociated with said predefined behaviors of interest.
 16. The LIMSrecited in claim 1, wherein the LIMS is further configured to respond topredefined triggering events by acquiring high and/or low accuracylocation estimates, wherein said predefined triggering events includedetection of at least one of the following types of network transactionwithin a wireless communications network: (1) MobileOriginations/Terminations; (2) Short Message Service (SMS)Originations/Terminations; (3) Mobile Attach/Detach events; (4)Registration/Location/Routing Update; (5) Handovers; and (6) CallReleases.
 17. The LIMS recited in claims 16, wherein the LIMS is furtherconfigured to collect mobile identifiers and triggered events; store thecollected data; analyze the collected data for suspect behaviors; andassign an index probability to each of a plurality of mobile devices.18. The LIMS recited in claim 1, wherein the LIMS is further configuredto perform an Area Presence Determination process for determiningwhether a specific mobile device was present in an area-of-interest(AOI) at a specific time.
 19. The LIMS recited in claim 1, wherein theLIMS is further configured to use location information to identify firstand second mobile devices as being associated based on the first andsecond mobile devices having highly correlated geo-profiles as afunction of time.
 20. The LIMS recited in claim 19, wherein the LIMS isfurther configured to perform high accuracy surveillance to validatethat said first and second mobile devices are associated and to identifyperiods of time when they are apart.
 21. The LIMS recited in claim 19,wherein the LIMS is further configured to use location information toidentify the first and second mobile devices as being indirectlyassociated based on the first and second mobile devices havinggeo-profiles that are similar but offset in time.
 22. The LIMS recitedin claim 1, wherein the LIMS is further configured to identify a user ofa specific mobile device based on a geo-profile of the specific mobiledevice.
 23. A method for use by a wireless location system to detectunlawful border crossing activities, comprising: (a) collecting datarepresenting wireless device cellular events, said data representing thelocations of wireless devices as they are registering with a wirelesscommunications network (WCN) and the times of the cellular events; and(b) analyzing the collected data representing wireless device cellularevents in areas near a border to identify a collection of cellularevents associated with an unlawful border crossing.
 24. The methodrecited in claim 23, wherein the data concerning network events includeshistorical data and metadata.
 25. The method recited in claim 23,wherein the collection of cellular events comprises a cluster ofcellular events occurring within a defined geographic area.
 26. Themethod recited in claim 25, wherein the cluster of cellular events is inthe area of a portal of an unlawful border crossing tunnel.
 27. Themethod recited in claim 23, wherein the collection of cellular eventscomprises a string of cellular events along a flight path of anaircraft, wherein said flight path represents an unlawful bordercrossing.
 28. A location information management system (LIMS),comprising: a controller computer; and one or more databases operativelycoupled to the controller computer and configured to store network eventhistorical data and metadata; wherein the LIMS is configured to utilizethe network event historical data and the metadata to producelocation-aware intelligence including geo-profiles for mobile devices,wherein said geo-profiles include location and time information for saidmobile devices.